Subject: [Netconf] partial-lock, sec. 2.4.1.1

From: Andy Bierman <[email-masked]>
Date: Mon, 21 Jun 2010 11:05:53 -0700

Hi,

Now that I am re-reading RFC 5717 in the context of a
specific access control model, instead of in the abstract,
this paragraph seems wrong:

   If access control denies the partial lock, the <error-tag> is
   'access-denied'.  Access control SHOULD be checked before checking
   for conflicting locks to avoid giving out information about other
   sessions to an unauthorized client.

XPath becomes somewhat useless, due to inadvertent
matching of nodes for which the user does not have access,
if access-denied is returned instead of skipping the unauthorized node.
E.g., the request select="//interface[starts-with(name, 'eth')]"
might match an ethernet interface that this user is unaware of,
because it is never visible in <get> replies for that user.

The server understands that, and interprets the request as
"select all the interfaces that I have proper access rights,
which also match this filter".  The list of locked nodes will never
include one that is unauthorized for that user.

The locked node set may end up being empty due to access control,
but the entire request will not be rejected because the server
removes some of the nodes that would have matched, if the user
had proper access rights.  The reply always states exactly
what was locked.

Andy